A full semester IT infrastructure project — multi-site enterprise network, Kubernetes-based cloud services, GitOps automation, VoIP telephony, and full-stack monitoring. Designed, built, tested, and demonstrated as a working system.
Nederlandse versie · Network Design · Server Infrastructure · Application & PoC · DevOps & CI/CD · Installation
TropoMetrics is a fictional international weather data company, used as the case study for a full-semester infrastructure design project at De Haagse Hogeschool (The Hague University of Applied Sciences). The assignment had two equally important parts: design and deliver a production-grade IT infrastructure for a company with offices in three countries, and develop a fully functional weather service to run on top of it — all from scratch.
For the weather service, the team was permitted to use Open-Meteo as the upstream data API (a free, open-source weather API), keeping the focus on the infrastructure, architecture, and integration rather than raw meteorological data processing. The result is a complete full-stack application — a React frontend, a Node.js/Redis caching proxy, and Kubernetes-based deployment — built and maintained by the team.
The team applied Design Science Research (DSR) methodology, moving from requirements analysis and stakeholder interviews through architecture design, physical lab implementation, Kubernetes deployments, and a live demonstration before assessors in January 2026.
This repository is the central documentation hub for all work across the TropoMetrics GitHub organisation.
| Name | Role | Responsibilities |
|---|---|---|
| Kai Diemel | Project Lead | Network, frontend development, documentation |
| Max Blaauw | 2nd Project Lead | Network engineering, infrastructure, DevOps, front- & backend |
| Ole Spiegelenberg | DevOps, security, research | |
| Arne Jansonius | Network, network design, documentation, research |
This project covers the complete IT stack of a mid-sized international technology company. Every component was designed with a production mindset and tested against a formal Programme of Requirements.
A hierarchical, dual-redundant network across Delft (HQ), Aruba, and Melbourne, simulated in Cisco Packet Tracer and documented with full device configurations.
Routing & Redundancy
- Dual-stack IPv4 + IPv6 (SLAAC) —
10.10.0.0/16(Delft),10.20.0.0/16(Aruba),10.30.0.0/16(Melbourne) - HSRP (Hot Standby Router Protocol) for gateway redundancy — failover within 10 ICMP packets
- OSPFv2 + OSPFv3 intra-site routing — all adjacencies maintained in FULL state
- eBGP peering with ISP (AS 1000) and iBGP between sites (AS 2000)
- IPsec/GRE VPN tunnels connecting all three sites — dual-tunnel WAN failover
Switching & Segmentation
- EtherChannel (LACP) uplink bonding between core and distribution layers
- VLAN segmentation:
STAFFNET(per department),CALCNET(servers),INTRANET,DMZNET(public) - Detailed VLAN plan with 15+ VLANs across all three sites
Layer 2 Security
- Port Security — MAC address limiting per port
- DHCP Snooping — trusted/untrusted port enforcement
- Dynamic ARP Inspection (DAI) — ARP spoofing prevention
- IP Source Guard (IPSG) — IP spoofing prevention
- Blackhole VLANs for all unused switch ports
- ACL-based inter-VLAN traffic control (VACL, PACL, standard ACL)
→ Cisco configs & Packet Tracer files · Full network design docs
All services ran as virtual machines on a physical Proxmox VE host, connected via Linux bridges acting as virtual L2 switches.
| VM | OS | Role |
|---|---|---|
| K3s nodes (×3) | Alpine Linux | Kubernetes cluster — cloud-native workloads |
| Windows Server | Windows Server | Active Directory DC, DHCP, print server, file server, PRTG Network Monitor |
| Issabel PBX | CentOS/Issabel | VoIP telephone exchange (FreePBX/Asterisk fork) |
| Stalwart mail | Debian | Mail server for @tropometrics.tech |
| Zammad / CRM / HRM | Linux | Business applications |
A complete VoIP phone system, replacing legacy analogue telephony infrastructure:
- Issabel PBX (a FreePBX fork, powered by Asterisk) deployed as a Proxmox VM
- IVR (Interactive Voice Response) — inbound calls automatically routed to departments based on menu choice
- SIP softphones for remote/PC-based calling
- Physical SIP desk phones for office use
- Analogue phones connected via a Grandstream ATA (Analogue Telephone Adapter)
- Integrated into the company network through the INTRANET VLAN
→ Infrastructure & telephony docs
Two complementary monitoring systems covering both the physical network layer and the cloud-native application layer:
Network Layer — PRTG Network Monitor
- Deployed on the Windows Server VM
- SNMP v3 monitoring of all Cisco switches, routers, and servers
- Real-time uptime tracking, interface statistics, CPU/memory utilisation
- Alert thresholds for availability SLA (99.999% target)
Application Layer — Prometheus + Grafana (standalone VM) + Alertmanager
- Prometheus — metrics scraping from K3s cluster (nodes + pods)
- Grafana — standalone VM (
10.10.80.21, VLAN 180) with dashboards for CPU, memory, disk, network, and pod performance - Alertmanager — alert routing and notification from within the K3s cluster
- PRTG additionally monitors service availability (ping probes, status detection within 60 seconds — NFR-M6)
→ Full monitoring documentation
The central application deliverable — a fully working weather data platform deployed on Kubernetes:
Frontend: look-at-this-weather
- React 18 + TypeScript + Vite
- Real-time weather data (temperature, humidity, wind speed, pressure)
- 24-hour hourly and 7-day weekly forecasts
- Maritime conditions view (wind and wave data)
- Browser-based weather alerts and notifications
- Dark/light mode with Tailwind CSS
- Responsive for desktop, tablet, and mobile
- Deployed to GHCR:
ghcr.io/tropometrics/look-at-this-weather
Backend: api-server
- Node.js + Express.js caching proxy for the Open-Meteo API
- Redis-backed response caching with configurable TTL (default: 3600s)
- Prevents upstream rate limiting by reusing cached responses
- Cache key generated from endpoint + query parameters
/healthendpoint reporting Redis connection status- Deployed via Docker + Kubernetes
→ Application architecture docs · look-at-this-weather repo · api-server repo
- ArgoCD on K3s — declarative GitOps; all desired cluster state defined in YAML → ArgoCI-CD repo
- GitHub Actions — CI pipeline: build Docker images, run tests, push to GHCR on merge to
main - Self-healing — ArgoCD continuously reconciles Git state vs. live cluster; any drift is auto-corrected
- Horizontal Pod Autoscaler (HPA) — weather service scales 2-10 replicas at 50% CPU threshold
- MetalLB — bare-metal load balancer assigning static IPs to services
- Traefik — Kubernetes Ingress Controller routing external traffic to services
- Cisco ISR 4331 — router with Zone-Based Firewall at the network perimeter
- Active Directory + LDAP — centralised identity management and authentication
- 802.1X — port-based network access control (no rogue devices)
- SNMPv3 — encrypted and authenticated network monitoring
- SSH-only remote management (Telnet disabled across all devices)
- IPsec-encrypted inter-site WAN traffic (100% of inter-site packets encrypted)
- VLAN isolation with ACL enforcement between segments
| Application | Purpose | Access |
|---|---|---|
| Zammad | Helpdesk ticketing — auto-creates tickets from support@tropometrics.tech |
Via subdomain |
| CRM | Customer relationship management | Via subdomain |
| HRM | Human resources management | Via subdomain |
| Stalwart | Open-source mail server for @tropometrics.tech |
SMTP/IMAP |
┌─────────────────────────┐
│ INTERNET / ISP AS1000 │
│ BGP, 1.1.1.1 │
└────────┬────────┬────────┘
│ │
┌─────────────────┘ └──────────────────────┐
│ Delft: 145.34.45.0/30 │
│ Aruba: 145.34.46.0/30 Melbourne: 145.34.47.0 │
┌────────▼────────┐ ┌──────────────┐ ┌────────▼───────┐
│ DELFT HQ │◄─IPsec VPN─►│ ARUBA │ │ MELBOURNE │
│ 10.10.0.0/16 │ │ 10.20.0.0/16 │ │ 10.30.0.0/16 │
└────────┬────────┘ └──────────────┘ └────────────────┘
│◄──────────────── IPsec VPN ────────────────────────────►┘
│
┌────────▼────────────────────────────────────────────────────────┐
│ DELFT CORE NETWORK │
│ Router1 + Router2 (BGP, OSPF, NAT, ACL) │
│ C-MLS01 + C-MLS02 (HSRP, OSPF, EtherChannel) │
│ ALS01-ALS06 (Port Security, DHCP Snooping, DAI, IPSG) │
│ │
│ VLANs: 110 Mgmt&Admin | 120 Sales | 130 Support │
│ 140 IT | 150 Dev | 160 Meteo │
│ 170/180/190 Servers | 191 DMZ | 192 Network Mgmt │
└────────┬────────────────────────────────────────────────────────┘
│
┌────────▼────────────────────────────────────────────────────────┐
│ PROXMOX VE HOST │
│ Linux bridges → virtual L2 switching between VMs │
│ │
│ ┌──────────────────────┐ ┌──────────────────────────────┐ │
│ │ K3s CLUSTER │ │ WINDOWS SERVER VM │ │
│ │ (3× Alpine Linux) │ │ • Active Directory DC │ │
│ │ │ │ • DHCP Server │ │
│ │ • Weather frontend │ │ • Print & File Server │ │
│ │ • API server + Redis │ │ • PRTG Network Monitor │ │
│ │ • ArgoCD (GitOps) │ │ (SNMP v3 → all devices) │ │
│ │ • Prometheus │ └──────────────────────────────┘ │
│ │ • Grafana │ ┌──────────────────────────────┐ │
│ │ • Alertmanager │ │ ISSABEL PBX VM │ │
│ │ • Alertmanager │ │ • FreePBX / Asterisk │ │
│ │ • MetalLB │ │ • IVR menu │ │
│ │ • Traefik │ │ • SIP softphones │ │
│ └──────────────────────┘ │ • SIP desk phones │ │
│ ┌──────────────────────┐ │ • Analogue phones (via ATA) │ │
│ │ STALWART MAIL VM │ └──────────────────────────────┘ │
│ │ @tropometrics.tech │ ┌──────────────────────────────┐ │
│ └──────────────────────┘ │ Zammad · CRM · HRM │ │
│ └──────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
| Category | Technologies |
|---|---|
| Network | Cisco IOS — OSPF, BGP, HSRP, IPsec, GRE, EtherChannel, VLAN, ACL, NAT |
| Virtualisation | Proxmox VE, Linux KVM/QEMU, Alpine Linux, Debian, Windows Server |
| Containers | Docker, Kubernetes/K3s, Helm, MetalLB, Traefik |
| GitOps / CI/CD | ArgoCD, GitHub Actions, GHCR |
| Monitoring (Network) | PRTG Network Monitor, SNMPv3 |
| Monitoring (App) | Prometheus, Grafana (standalone VM), Alertmanager |
| Identity | Windows Server Active Directory, LDAP, 802.1X |
| Telephony | Issabel PBX (FreePBX/Asterisk), SIP, IAX2, Grandstream ATA |
| Backend | Node.js, Express.js, Redis, Axios |
| Frontend | React 18, TypeScript, Vite, Tailwind CSS, TanStack Query |
| Stalwart Mail Server | |
| Ticketing | Zammad |
| Security | Cisco ISR 4331 (ZBF), DHCP Snooping, DAI, IP Source Guard, Port Security |
All 18 functional and 11 non-functional requirements were tested on 21 January 2026 in the network lab. Key results:
| Requirement | Description | Result |
|---|---|---|
| NFR-M1 | HSRP failover within 10 ICMP packets | |
| NFR-M2 | EtherChannel member interfaces active | |
| NFR-M3 | OSPFv2/v3 adjacency FULL on all devices | |
| NFR-M4 | WAN auto-failover via secondary GRE tunnel | |
| NFR-M5 | IPv6 end-to-end reachability (SLAAC) | |
| NFR-M6 | PRTG detects service outage within 60 seconds | |
| NFR-M7 | 100% inter-site traffic encrypted via IPsec | |
| FR-M9 | AD domain join and user authentication | |
| FR-M11 | K3s nodes Ready, no crashloops | |
| FR-M12 | ArgoCD Synced and Healthy | |
| FR-M13 | SNMP monitoring via PRTG | |
| FR-M14 | Grafana dashboards with live metrics | |
| FR-M16 | IVR routing inbound calls to departments | |
| FR-M18 | Zammad auto-creates tickets from email |
| Repository | Description |
|---|---|
| TropoMetrics/tropometrics-docs | This repo — central documentation (EN + NL) |
| TropoMetrics/look-at-this-weather | React/TypeScript weather frontend |
| TropoMetrics/api-server | Node.js/Redis caching API proxy |
| TropoMetrics/ArgoCI-CD | ArgoCD GitOps manifests + Kubernetes configs |
| TropoMetrics/Packet-Tracer-configs | Cisco IOS configs and Packet Tracer simulation files |
| TropoMetrics/.github | Organisation profile and overview |
| Document | English | Dutch |
|---|---|---|
| Network Design | docs/en/network-design.md | docs/nl/netwerkontwerp.md |
| Server Infrastructure | docs/en/infrastructure.md | docs/nl/infrastructuur.md |
| Application & PoC | docs/en/application.md | docs/nl/applicatie.md |
| DevOps & CI/CD | docs/en/devops-cicd.md | docs/nl/devops-cicd.md |
| Installation Guide | docs/en/installation.md | docs/nl/installatie.md |
Institution: De Haagse Hogeschool — Network Infrastructure Design (NID) Period: September 2025 - January 2026 Methodology: Design Science Research (DSR), 5 phases:
- Analysis — client interview with CEO Stefan Zwaard, research questions, DSR problem framing
- Design — network topology, IP plan, Programme of Requirements (PvE), architecture decisions
- Implementation & PoC — physical lab build, Kubernetes deployments, application development
- Testing & Validation — structured test plan covering all MoSCoW requirements, test report
- Delivery — final report, live demonstration before assessors, documentation handover
Research question: "Which weather forecasting service delivers the highest customer value for TropoMetrics?" — answered via literature review, CEO interview, and the functional PoC.
- Proxmox VE — zero-cost licence, Debian base, ZFS/LINSTOR storage support, long support cycles; suitable for production-grade virtualisation
- K3s over full Kubernetes — lower resource overhead, CNCF-certified, well-suited for a single-host lab cluster
- ArgoCD GitOps — all cluster state declared in Git; changes deploy automatically and self-heal without manual intervention
- Issabel PBX — open-source FreePBX fork, chosen to replace legacy analogue telephony with a modern SIP/VoIP system while supporting Grandstream ATA for analogue handsets
- PRTG on Windows Server — chosen for its deep SNMP integration and Windows-native monitoring; co-located with the Domain Controller to reduce VM count
- MetalLB + Traefik — provides production-like bare-metal load balancing and HTTP ingress in an on-premise Kubernetes environment
- Dual-stack IPv4/IPv6 — per IETF dual-stack migration guidelines (RFC 8200); ensures the network is future-proof
- Open-Meteo API + Redis cache — open-source weather data API; Redis caching prevents rate-limiting and reduces upstream load
Project period: September 2025 - January 2026 Institution: De Haagse Hogeschool · Programme: Network Infrastructure Design Authors: Max Blaauw · Arne Jansonius · Kai Diemel · Ole Spiegelenberg